From 5965346bdf9479b5c78313604784afcea3ab2060 Mon Sep 17 00:00:00 2001 From: Binal Patel Date: Tue, 11 Aug 2026 19:58:07 -0600 Subject: [PATCH 1/2] Document the SameSite requirement for SAML reauthentication --- server/configs/application.properties | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/server/configs/application.properties b/server/configs/application.properties index 365ce22ce9..9e69cd353f 100644 --- a/server/configs/application.properties +++ b/server/configs/application.properties @@ -117,6 +117,19 @@ mail.smtpUser=@@smtpUser@@ # HTTP session timeout for users - defaults to 30 minutes #server.servlet.session.timeout=30m +# SAML IdPs return authentication assertions via a cross-site POST. Without an explicit SameSite value, +# Chrome browser treats JSESSIONID as Lax and withholds it from that POST, except during a grace period covering +# cookies less than two minutes old. Reauthentication deliberately never replaces the session -- the +# signed-in session is what it verifies against -- so the cookie only ages, and any reauthentication more +# than a couple of minutes after sign-in arrives with no session cookie. That fails two ways: the request +# looks like a guest, producing a misleading "wrong user reauthenticated" error, and the response mints a +# guest session whose Set-Cookie overwrites the signed-in JSESSIONID, logging the user out. SameSite=None +# keeps the session attached to the callback and is only honored on Secure cookies, +# so this requires HTTPS. +#server.servlet.session.cookie.same-site=none +#server.servlet.session.cookie.secure=true +#server.servlet.session.cookie.http-only=true + ## Turn on JSON-formatted HTTP access logging to stdout. See issue 48565 ## https://tomcat.apache.org/tomcat-9.0-doc/config/valve.html#JSON_Access_Log_Valve #jsonaccesslog.enabled=true From a8afc322b6072da39dcc8971386ab9cf2bacad0c Mon Sep 17 00:00:00 2001 From: Binal Patel Date: Tue, 18 Aug 2026 23:44:21 -0600 Subject: [PATCH 2/2] Update comment --- server/configs/application.properties | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/server/configs/application.properties b/server/configs/application.properties index c478408588..284897febe 100644 --- a/server/configs/application.properties +++ b/server/configs/application.properties @@ -121,12 +121,12 @@ mail.smtpUser=@@smtpUser@@ #server.servlet.session.timeout=30m # SAML IdPs return authentication assertions via a cross-site POST. Without an explicit SameSite value, -# Chrome browser treats JSESSIONID as Lax and withholds it from that POST, except during a grace period covering -# cookies less than two minutes old. Reauthentication deliberately never replaces the session -- the +# Chromium-based browsers treat JSESSIONID as Lax and withhold it from that POST, except during a grace period +# covering cookies less than two minutes old. Reauthentication deliberately never replaces the session -- the # signed-in session is what it verifies against -- so the cookie only ages, and any reauthentication more -# than a couple of minutes after sign-in arrives with no session cookie. That fails two ways: the request -# looks like a guest, producing a misleading "wrong user reauthenticated" error, and the response mints a -# guest session whose Set-Cookie overwrites the signed-in JSESSIONID, logging the user out. SameSite=None +# than a couple of minutes after sign-in arrives with no session cookie. That fails two ways: the server sees +# a guest on that request and rejects the reauthentication, and the response mints a guest session whose +# Set-Cookie overwrites the signed-in JSESSIONID, logging the user out. SameSite=None # keeps the session attached to the callback and is only honored on Secure cookies, # so this requires HTTPS. #server.servlet.session.cookie.same-site=none